Flocksafety

flocksafety

15 CVEs • 4 products

Products (4)

Click to collapse

Toggle

Gunshot Detection Firmware

gunshot_detection_firmware

License Plate Reader Firmware

license_plate_reader_firmware

Bravo Compute Box Firmware

bravo_compute_box_firmware

CVEs (15)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-59409 1Flocksafety 1License Plate Reader Firmware Jun 17, 2026 Oct 2, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck) stored in cleartext in production firmware.
CVE-2025-59407 1Flocksafety 1Flock Safety Jun 17, 2026 Oct 2, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (floc...Show more The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles a Java Keystore (flock_rye.bks) along with its hardcoded password (flockhibiki17) in its code. The keystore contains a private key.Show less
CVE-2025-59406 1Flocksafety 1Flock Safety Jun 17, 2026 Oct 2, 2025 N/A· v4 6.2 MEDIUM· v3 N/A· v2 The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its co...Show more The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) has a cleartext Auth0 client secret in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover this OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.Show less
CVE-2025-59405 1Flocksafety 1Flock Safety Jun 17, 2026 Oct 2, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key...Show more The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompiled or inspected, attackers can recover the OAuth secret without special privileges. This secret is intended to remain confidential and should never be embedded directly in client-side software.Show less
CVE-2025-59403 1Flocksafety 1Flock Safety Jun 17, 2026 Oct 2, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera feed on Falcon, Sparrow, and Bravo devices, but exposes admini...Show more The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentication. It is responsible for the camera feed on Falcon, Sparrow, and Bravo devices, but exposes administrative API endpoints on port 8080 without authentication. Endpoints include but are not limited to: /reboot, /logs, /crashpack, and /adb/enable. This results in multiple impacts including denial of service (DoS) via /reboot, information disclosure via /logs, and remote code execution (RCE) via /adb/enable. The latter specifically results in adb being started over TCP without debugging confirmation, providing an attacker in the LAN/WLAN with shell access.Show less
CVE-2025-59408 1Flocksafety 1Bravo Compute Box Firmware Jun 17, 2026 Sep 25, 2025 N/A· v4 7.3 HIGH· v3 N/A· v2 Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with Secure Boot disabled. This allows an attacker to flash modified firmware with no cryptographic protections.
CVE-2025-59404 1Flocksafety 1Bravo Compute Box Firmware Jun 17, 2026 Sep 25, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 ships with its bootloader unlocked. This permits bypass of Android Verified Boot (AVB) and allows direct modification of partitions.
CVE-2025-59402 1Flocksafety 1Bravo Compute Box Firmware Jun 17, 2026 Sep 25, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, d...Show more Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls.Show less
CVE-2025-47824 1Flocksafety 1License Plate Reader Firmware Jun 17, 2026 Jun 27, 2025 N/A· v4 2.4 LOW· v3 N/A· v2 Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.
CVE-2025-47823 1Flocksafety 1License Plate Reader Firmware Jun 17, 2026 Jun 27, 2025 N/A· v4 4.6 MEDIUM· v3 N/A· v2 Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.
CVE-2025-47822 1Flocksafety 1License Plate Reader Firmware Jun 17, 2026 Jun 27, 2025 N/A· v4 6.8 MEDIUM· v3 N/A· v2 Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control.
CVE-2025-47821 1Flocksafety 1Gunshot Detection Firmware Jun 17, 2026 Jun 27, 2025 N/A· v4 4.6 MEDIUM· v3 N/A· v2 Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.
CVE-2025-47820 1Flocksafety 1Gunshot Detection Firmware Jun 17, 2026 Jun 27, 2025 N/A· v4 2.4 LOW· v3 N/A· v2 Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.
CVE-2025-47819 1Flocksafety 1Gunshot Detection Firmware Jun 17, 2026 Jun 27, 2025 N/A· v4 6.8 MEDIUM· v3 N/A· v2 Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control.
CVE-2025-47818 1Flocksafety 1Gunshot Detection Firmware Jun 17, 2026 Jun 27, 2025 N/A· v4 4.6 MEDIUM· v3 N/A· v2 Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.